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ABSTRACT 

Orbital debris impacts on the International Space Station occur frequently. To date, none of the impacting particles 
has been sufficiently large to penetrate manned pressurized volumes. We used the Manned Spacecraft Crew 
Survivability code to evaluate the risk to crew of penetrations of pressurized modules at two assembly stages: after 
Flight 1J, when the pressurized elements of Kibo, the Japanese Experiment Module, are present, and after Flight 
IE, when the European Columbus Module is present. Our code is a Monte Carlo simulation of impacts on the 
Station that considers several potential event types that could lead to crew loss. Among the statistics tabulated by 
the program is the probability of death of one or more crew members, expressed as the risk factor, R. This risk 
factor is dependent on details of crew operations during both ordinary circumstances and decompression 
emergencies, as well as on details of internal module configurations. We conducted trade studies considering these 
procedure and configuration details to determine the bounds on R at the 1J and IE stages in the assembly sequence. 
Here we compare the R-factor bounds, and procedures and configurations that reduce R at these stages. 


MSCSurv PROGRAM 

Orbital debris in Low Earth Orbit (LEO) poses a collision risk to active satellites, including the International 
Space Station (ISS). NASA has developed methods for modeling orbital debris hypervelocity impacts on the ISS, 
such as the BUMPER code. In addition to modeling impacts and penetrations, it is necessary to analyze the effects 
on crewmen and their operations after a penetration. To aid NASA in this goal, the University of Denver Research 
Institute (DRI) developed a computer program to specifically model impacts and quantify the damage risks to crew 
and spacecraft. The Manned Spacecraft and Crew Survivability (MSCSurv) code computes several statistics 
concerning results of penetrations of pressurized volumes, including the likelihood of crew loss. Results from 
hazard assessments performed with this program suggest modifications to planned crew operations during 
decompression emergencies to enhance crew safety. 


Processing Flow , , , 

MSCSurv is a Monte-Carlo based simulation code, written in FORTRAN, and specifically developed to 

predict the ratio of penetrations leading to the loss of at least one crewmember to the total number of penetrations - 
the risk factor, R, for the manned modules of the ISS. In preparing for an MSCSurv run, the analyst must make 
assumptions regarding crew operations, crew vulnerability to hazardous conditions, hypervelocity impact 
phenomena, and other factors. Each of these assumptions carries an uncertainty, and MSCSurv calculates 
uncertainty bounds associated with the R-factors, based on the parameter uncertainties and distributions supplied by 
the analyst. Following a specified number of penetrations (typically 10 6 ) using one set of parameter values, and 
comprising one simulation, MSCSurv varies input parameters and continues performing simulations. Experience 
has shown that a few hundred simulations (i.e., a few hundred million penetrations) may be required to develop 


reliable statistics. After running the required number of simulations, MSCSurv determines the mean value of each 
module's R-factor along with its associated two-standard-deviation (i.e., 2-sigma) uncertainty bounds, plus 
composite R-factors for the U.S. Segment, Russian Segment, and ISS as a whole. 

A single pass through MSCSurv involves accessing the Impact Model, the Penetration and Damage Model, 
and the Spacecraft and Crew Loss Model. In the Impact Model a particle size, velocity, and approach direction are 
randomly selected based on the applicable orbital debris population model, which for our assessments was NASA’s 
ORDEM96 (Kessler et al., 1996?). Next an impact location is selected randomly from those ISS elements exposed 
to particles from the selected approach direction, taking into account any shadowing by other ISS elements. 

Having selected the particle and impact location, the flow proceeds to the Penetration and Damage Model, 
where the shield characteristics at the impact location are examined, and a determination made as to whether the 
particle could penetrate this element. If the shield ballistic limit indicates that the particle could not penetrate, 
processing returns to the Impact Model, and another particle, speed, and direction are drawn. If the particle does 
penetrate, damage equations are used to determine the hole and crack sizes expected to be produced by this 
penetration. The flow then passes to the Spacecraft and Crew Loss Model. 

The Spacecraft and Crew Loss Model examines a cascade of damage possibilities; the determination of a loss 
at any of them sends the flow to the Loss Recording step without examining any less-catastrophic loss types. Loss 
types in the cascade are: 1) presence at the impact site of propellant tanks or other external equipment that could 
rupture and explosively depressurize a module they are attached to; 2) unbounded crack growth in the manned 
module pressure wall (“unzipping”); 3) destruction of critical internal equipment behind the point of impact; 4) 
destruction of payloads behind the point of impact, releasing toxic or high-energy substances in the vicinity of 
crew; 5) death due to hypoxia following the penetration; 6) crew injury due to fragments, pressure pulse, light 
flash, etc., associated with a nearby penetration; and 7) inability to depart in the escape vehicle due to generation of 
excessive ISS rotation rates by thrust of the gas venting from a penetration hole. Williamsen et al. (2001) provide 
more details of the analysis performed in the various models of the MSCSurv code. 

STUDY BACKGROUND 

This paper describes the R-factor analysis at two stages in the ISS assembly sequence, denoted IJ and IE. 
During the Space Shuttle Flight designated as 1J the final pressurized elements of Kibo, the Japanese Experiment 
Module, are to be delivered, and on Flight IE the European Columbus Module will be added. Modules present 
prior to these flights include the Service Module, FGB (Z arya). Universal Docking Module (UDM), Docking 
Compartment, Science Power Platform (SPP), Pressurized Mating Adapter-1 (PMA-1), Node 1, U.S. Laboratory, 
Airlock and High Pressure Gas Compartment, Node 2, PMA-2, and PMA-3. In addition, our models included a 
Progress resupply vehicle docked to the aft docking port of the Service Module, and a Soyuz crew return vehicle. 
For 1J the Soyuz was docked at the nadir port of the Docking Compartment. For IE the Docking and Stowage 
Module, Node 3, PMA-3, and Cupola were added, and the Soyuz was docked to the Docking and Stowage 
Module’s nadir port. Illustrations of the 1J and IE configurations are given in Figure 1. 

The configuration data, including shield characteristics and geometries, was obtained from Prior (2000). 
Locations of internal equipment on the U.S. side were derived from Miller et al. (2000). Locations of internal 
equipment on the Russian side were adapted from Williamsen et al. (2001) and discussions with civil service and 
contractor personnel at Johnson Space Center (JSC) (Berdich, 2000, 2001; Lee, 2001). 

Crew operations protocols were based on discussions with JSC personnel (Lamczyk, 2000, 2001, Alibaruho, 
2000,2001), as well as emergency procedures documents prepared by NASA’s Mission Operations Directorate 
(2001). A time of day was randomly selected for each penetration, and locations of crewmen assigned based on it. 
During the eight “sleep” hours, two crewmen were located in the aft portion of the Service Module and one in the 
U.S. Lab. During the sixteen “work” hours, crew locations were randomly selected based on frequency of module 
occupancy. Assumed occupancy times ranged from as few as seven minutes per day for infrequently-visited 
modules such as the SPP, to over four hours for the aft portion of the Service Module. 


1J CONFIGURATION 


KIBO (JEM ELM, JEM PM) MODULES 



COLUMBUS (ESA APM) MODULE 



IE CONFIGURATION 


NODE 3, CUPOLA, 
PMA-3 

DOCKING & STOWAGE 
MODULE 


Fig. 1 . International Space Station configurations used in this study. 

STUDY OBJECTIVES 

Objectives of this study were to: 

1) Quantify the R-factor and its two-sigma upper and lower bounds for the 1J and IE configurations. 

2) Study the effect of alternate crew procedures on R-factors. 

3) Use R-factors in conjunction with Probability of No Penetration (PNP) from the BUMPER program 
analysis in Prior (2000) to estimate Probability of Crew Loss (PCL) at the 1J and IE stages. 

R-FACTOR COMPUTATION RESULTS 

R-factors for Stage 1J - Baseline 

The R-factor results for the 1J configuration, using baseline inputs, are given in Table 1. The overall R-factor 
mean value of 0.250 indicates that approximately one in four penetrations of the station will lead to the death of one 
or more persons at Stage 1J. 

Composite R-factors are determined by weighting each module's R-factor by its likelihood of penetration. At 
this assembly stage about 93% of penetrations occur on the Russian side, so the Russian R-factors drive the overall 
R-factor. The NASA portion of the station tends to require larger particles to penetrate the shielding, so in the 
event of a penetration the hole sizes, crack lengths, and penetration depths tend to be larger. MSCSurv predicts a 
mean R factor of 0.408 for the NASA side of the station and 0.238 for the Russian side. 

The largest contributor to the R-factor (i.e., most significant cause of death) on both sides of the station is 
hypoxia, accounting for 44.4% of the overall R. Critical external equipment failure is the second leading 
contributor, accounting for 34.4% of total R. 


Table 1 . Baseline R-factors by module, segment, and overall at Stage 1 J 


Module 2.275 % Mean 97.725 % 


AIRLOCK 

0.489 

0.596 

0.715 

HPGC 

0.063 

0.072 

0.080 

JEM ELM 

0.431 

0.523 

0.690 

JEM PM 

0.350 

0.481 

0.682 

PMA 1 

0.151 

0.271 

0.503 

PMA 2 

0.172 

0.336 

0.573 

PMA 3 

0.194 

0.332 

0.555 

NODE 1 

0.183 

0.304 

0.498 

NODE 2 

0.258 

0.397 

0.601 

US LAB 

0.430 

0.567 

0.732 

FGB 

0.574 

0.708 

0.784 

PROG 

0.142 

0.261 

0.330 

SOYUZ 

0.141 

0.147 

0.157 

SPP 

0.006 

0.010 

0.014 

UDM 

0.657 

0.844 

0.946 

DK COMP 

0.031 

0.080 

0.103 

SERVFWD 

0.300 

0.381 

0.437 

SERVAFT 

0.108 

0.151 

0.283 

NASA 

0.297 

0.408 

0.587 

RSA 

0.182 

0.238 

0.301 

ISS 

0.192 

0.250 

0.316 


Nonfatal injuries, loss of station attitude control, and Service Module depressurization all require 
abandonment of the station by the crew. These outcomes are only tallied by MSCSurv when no lethal failure mode 
occurs. Including these outcomes, our baseline runs predict that on average 58.5% of penetrations will result in 
either one or more deaths or a non-fatal event requiring evacuation of the crew, with a ± two-sigma confidence 
interval of 0.530 to 0.634. 

R-factors for Stage 1J - Modified Procedures 

In addition to analyzing the baseline case, we performed analyses to examine the effects of modifications to 
crew emergency procedures. The baseline rules call for the crew to gather in the Service Module on warning of a 
depressurization event, then proceed to the Soyuz to check its integrity. Only if the Soyuz is undamaged and 
pressure and pressure rate readings indicate at least 30 minutes remain before station cabin pressure reaches a 
“critical” value (-660 mm Hg - “bail pressure”) does the crew egress the Soyuz and attempt to isolate the leak. 
Although ISS has several Portable Breathing Apparatus (PBA) stations, donning these is not called for in the 
depressurization emergency rules. 

Our procedure modifications included: 1) having the crew don PBA’s upon warning of a depressurization 
event; 2) having the crew PBA’s and isolate holes when the holes are heard (a minimum hole size of at least 2 cm is 
needed, and someone must pass the hole on their way through the affected module) even prior to Soyuz checkout; 
3) having the crew isolate holes when they are heard even prior to Soyuz checkout (no PBA’s); 4)ordered hatch 
closure, using only a bail pressure (not bail time) of 510 mm Hg as a stopping condition; and 5) isolate holes upon 
hearing even prior to Soyuz checkout and use only the bail pressure as a bail condition. 

Table 2 presents the mean ISS R-factors for each trade study. Donning PBA’s, with no other changes to 
baseline assumptions, decreases hypoxia deaths dramatically (hypoxia decreased from 11.1% to 4.0%), giving a 
decline in R from 0.250 to 0. 182. When the crew is using PBA’s and isolating holes heard prior to Soyuz checkout, 
hypoxia increased by about 1% and crew departures decreased by about 2% compared to when the crew is using 
PBA’s, but not isolating holes prior to Soyuz checkout. Early isolation alone or using a lower bail pressure result in 

larger R’s. 


Table 2. Comparison of R-factors from baseline operations rules and various altered rules, 1 J configuration 


Baseline 

PBA’s 

PBA’s + Early Isol. 

Early Isol. 

Bail at 510 

Early Isol. + Bail at 510 

Overall R: 0.250 
Hypoxia R: 0.11 1 

0.182 

0.040 

0.193 

0.050 

0.258 

0.115 

0.268 

0.125 

0.278 

0.137 


R-factors for Stage IE - Baseline 

As mentioned above, several modules were added to the 1J configuration, or moved, to give the configuration 
at IE. In addition, work day occupancy times were revised to include the new modules. Baseline R-factor results 
for IE are given in Table 3. The overall mean R-factor has increased slightly from the 1J value to 0.277. The R- 
factor for the NASA side is down slightly, to 0.379, while the Russian side value has increased slightly, to 0.267. 


Table 3. Baseline R-factors by module, segment, and overall at Stage 1 E 


Module 

2.275 % 

Mean 

97.725 % 

AIRLOCK 

0.467 

0.554 

0.657 

HPGC 

0.070 

0.076 

0.083 

JEM ELM 

0.414 

0.483 

0.610 

JEM PM 

0.359 

0.459 

0.621 

ESA 

0.457 

0.515 

0.593 

PMA 1 

0.134 

0.228 

0.403 

PMA 2 

0.189 

0.331 

0.526 

PMA 3 

0.176 

0.267 

0.435 

NODE 1 

0.138 

0.231 

0.370 

NODE 2 

0.203 

0.276 

0.408 

NODE_3 

0.224 

0.305 

0.466 

US LAB 

0.432 

0.548 

0.667 

CUPOLA 

0.323 

0.427 

0.564 

FGB 

0.552 

0.690 

0.770 

PROG 

0.148 

0.276 

0.334 

SOYUZ 

0.140 

0.148 

0.159 

SPP 

0.007 

0.014 

0.018 

UDM 

0.645 

0.818 

0.937 

DK COMP 

0.030 

0.074 

0.086 

DK STOW 

0.729 

0.879 

0.951 

SERVFWD 

0.196 

0.335 

0.408 

SERVAFT 

0.104 

0.141 

0.239 

NASA 

0.303 

0.379 

0.507 

RSA 

0.219 

0.267 

0.315 

ISS 

0.230 

0.277 

0.329 


At Stage IE about 91% of all penetrations occur on the RSA side, down from 93% at 1 J, presumably because 
several large modules have been added to the NASA segment, at the front of the station. Again, the largest 
contributor to R is hypoxia, at 42.6%, and critical external equipment failure is second at 35.4% of R. The added 
RSA module. Docking and Stowage, has high individual R’s for both external equipment and hypoxia. The 
presence of this module in an exposed position increased the composite R for the station. 

R-factors for Stage IE - Modified Procedures 

We repeated the alternative procedure trades discussed above for the IE configuration, with R-factor 
outcomes given in Table 4. 


Table 4. Comparison of R-factors from baseline operations rules and various altered rules, 1 E configuration 


Baseline 

PBA’s 

PBA’s + Early Isol. 

Early Isol. 

Bail at 510 

Early Isol. + Bail at 510 

Overall R: 0.277 
Hypoxia R: 0.118 

0.194 

0.032 

0.192 

0.033 

0.275 

0.121 

0.294 

0.138 

0.308 

0.150 


As in the 1J case, donning PBA’s dramatically improved survivability, and isolating modules where a hole is 
heard, prior to congregating at the Soyuz, also helped. Attempts at either isolating heard holes or using an ordered 
hatch closure protocol, without use of PBA's, either did not improve survival or impared it 

PROBABILITY OF CREW LOSS 

The final calculations determined the Probability of Crew Loss (PCL) for the ISS due to orbital debris 
penetrations at each of the 1J and IE stages. PCL can be calculated as 

PCL=1-PNP r 0 ) 

where PNP is the Probability of No Penetration during the time span of interest. ISS is expected to be in the 1J 
configuration for a span of approximately 0.46 year during 2003 - 2004, and in the IE configuration for about one 
year beginning in 2004. PNP calculations were obtained from the BUMPER code; we associate no uncertainties 
with its output. Bounded PCL’s for baseline operations rules and for use of PBA’s upon depressurization warning 
are given in Table 5. 


Table 5. Probability of Crew Loss predictions for baseline and PBA cases 


Baseline PBA 



PNP 

2.275% 

Mean 

97.725% 

Mean 

1J 

IE 

0.9919279 

0.9809788 

0.156% 

0.441% 

0.202% 

0.531% 

0.256% 

0.630% 

0.147% 

0.372% 
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